Machinery Safety 101

Can Emergency Stop be used as an “on/off” control?

This entry is part 16 of 16 in the series Emer­gency Stop

Every couple of months I get an email ask­ing me if there is any reas­on why e‑stop func­tions can­’t be used as the primary power con­trol (on/off but­ton) for machinery. Fol­low­ing a recent exchange, I thought I would share the reas­ons for why this is such a bad idea. 

The short answer

The short answer is an unequi­voc­al NO. Don’t do it as it is very likely to end in tears.

The long answer

First, I’m going to take you back to the defin­i­tion of emer­gency stop found in ISO 13850 [1]:

, Can Emergency Stop be used as an “on/off” control?, Machinery Safety 101

As you can see, there is noth­ing in defin­i­tion of an emer­gency stop func­tion that relates to using it as the on/off power switch for the machinery.

There are many reas­ons to not mis­use the emer­gency stop func­tion including:

  • The emer­gency stop func­tion is inten­ded for use in emer­gency con­di­tions. Using it for every day on/off func­tions makes a psy­cho­lo­gic­al dif­fer­ence in how oper­at­ors per­ceive the estop function/device. Con­sider that one of the design goals for con­trols engin­eers is to bring the machinery to a stop as quickly as pos­sible, ideally without dam­age, but break­ing the machine is not out of the ques­tion. If oper­at­ors get used to using the estop but­ton cas­u­ally, this use can be subtly or overtly dam­aging the machine every time the but­ton is pressed. This is clearly poor prac­tice at best.
  • The stand­ards that include inform­a­tion on the emer­gency stop func­tion (ISO 13850 [1], IEC 60204 – 1 [2], NFPA 79 [3], CSA C22.2 #301 [4]) don’t address the “prop­er use” of the emer­gency stop func­tion. The elec­tric­al design stand­ards only deal with the way all stop func­tions (cycle stop, on/off, emer­gency stop, etc.) are expec­ted to oper­ate by defin­ing the stop func­tion cat­egor­ies, while ISO 13850 focuses exclus­ively on HOW the emer­gency stop func­tion is required to oper­ate. Only func­tion­al safety stand­ards (for machinery: ISO 13849 [5] and IEC 62061 [6]) address the effects of wear on these systems. 
  • ISO 13850 requires that the emer­gency stop func­tions oper­ate with at least PLc reli­ab­il­ity (a max­im­um fail­ure rate of 2.77 × 10-6 failures/hour [5, Annex K]). Power con­tact­ors, brakes, valves, and oth­er con­trol com­pon­ents have an oper­a­tion­al life usu­ally giv­en in oper­at­ing cycles. In some cases, there may be two dif­fer­ent oper­at­ing life­times to account for, i.e., a mech­an­ic­al life­time and an elec­tric­al life­time. ISO 13849 – 1 Annex C provides the means to take the rated life­time (called B10) and con­vert it to the life­time in which 10% of the com­pon­ent pop­u­la­tion will have failed dan­ger­ously (B10D), and then to take that num­ber and determ­ine the func­tion­al life­time of the com­pon­ent in the spe­cif­ic applic­a­tion (T10D). This num­ber is com­pared against the mis­sion time, which is set to 20 years in ISO 13849 – 1. Long story short: If you have a con­tact­or with a 5000 cycle life­time (this is an actu­al life­time taken from a large power con­tact­or. Your mileage may vary), and as a design­er you determ­ine that that con­tact­or has a long enough T10D to not need replace­ment in the 20 year mis­sion time based on your assump­tions about how often the e‑stop will be used, and your user starts using that but­ton at a much high­er rate than you anti­cip­ated then that con­tact­or is going to wear out long before expec­ted. If the emer­gency stop func­tion is real­ized using a single-chan­nel archi­tec­ture (ISO 13849 – 1 Cat­egory 1 or 2, both of which can achieve PLc), then a single com­pon­ent fail­ure can lead to the loss of safety func­tion WITHOUT WARNING. So, at the moment that your oper­at­or REALLY NEEDS that emer­gency stop to func­tion, it’s already failed and no one was the wiser. Now you’ve got a dead or severely injured work­er, and/or a des­troyed machine and lost pro­duc­tion on your hands. If you need to know more about these cal­cu­la­tions, see my series “How to Do an ISO 13849 – 1 Ana­lys­is.”

Some read­ers have con­flated the logic related to stop cat­egor­ies and the emer­gency stop func­tion. In a recent email, a read­er indic­ated that by their logic, “…if a Cat­egory 0 or 1 Stop can be used as an E‑Stop, then an E‑Stop can be used as a Stop.” This is get­ting the logic com­pletely back­ward and if fol­lowed is likely to end in tears.

Stop Categories

The stop cat­egor­ies (they ori­gin­ated in IEC 60204 – 1, but were brought into NFPA 79 and CSA C22.2 #301 from that source) describe how ANY stop func­tion can oper­ate [2]:

, Can Emergency Stop be used as an “on/off” control?, Machinery Safety 101

The emergency stop function

Read­ing on in IEC 60204 – 1 to the sec­tion describ­ing emer­gency stop:

, Can Emergency Stop be used as an “on/off” control?, Machinery Safety 101

ISO 13850 [7, Fig. 1], illus­trates how this func­tion is expec­ted to operate.

, Can Emergency Stop be used as an “on/off” control?, Machinery Safety 101

Refer­ring back to [1], we get this guid­ance on the design of the emer­gency stop function:

, Can Emergency Stop be used as an “on/off” control?, Machinery Safety 101


The second para­graph of [2,] is telling the design­er that the emer­gency stop func­tion has to either cut power imme­di­ately or cut power after allow­ing a brief peri­od for a grace­ful stop to occur. Cat­egory 0 stop will often res­ult in coast­ing of the machinery if there is suf­fi­cient iner­tia, so Cat. 1 stops are much more com­monly used. The big dif­fer­ence is in how a Cat. 1 used for e‑stop is designed, and how a Cat.1 cycle stop func­tion is designed; primar­ily TIME. In the emer­gency stop case, the brak­ing or stop­ping time must be as short as pos­sible, usu­ally just short of break­ing the machinery due to the stop­ping stresses. In a Cat. 1 cycle stop, the time delay will be long enough for the tool­ing to get to the start­ing point for the next machine cycle. So in the first case, the time frame might be 100 ms, while in the second case, the time frame might be 5 s. These are com­pletely dif­fer­ent scenarios.

As you can see, con­flat­ing the Emer­gency Stop Func­tion and the Stop Func­tion Cat­egor­ies is a major error.

As always, I look for­ward to your com­ments and questions!


[1] Safety of machinery – Emer­gency stop – Prin­ciples for design. ISO 13850. 2006.

[2] Elec­tric­al Equip­ment of Indus­tri­al Machines. IEC 60204 – 1. 2006.

[3] Elec­tric­al Stand­ard for Indus­tri­al Machinery. NFPA 79. 2015.

[4] Indus­tri­al elec­tric­al machinery. CSA C22.2 No. 301. 2016.

[5] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design. ISO 13849 – 1. 2015.

[6] Safety of machinery – Func­tion­al safety of safety-related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic­con­trol sys­tems­Safety of machinery – Func­tion­al safety of safety-related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic­con­trol sys­tems. IEC 62061. 2005.

[7] Safety of machinery – Emer­gency stop – Prin­ciples for design. ISO 13850. 1996.

Series Nav­ig­a­tionEmer­gency Stop Pull-CordsMore E‑Stop Questions

Privacy Preference Center




Site use analytics